CVE-2025-15033

Summary

A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.

Affected Software

VendorProductVersion RangeStatus
AutomatticWooCommerce8.1.0 < 8.1.3affected
AutomatticWooCommerce8.2.0 < 8.2.4affected
AutomatticWooCommerce8.3.0 < 8.3.3affected
AutomatticWooCommerce8.4.0 < 8.4.2affected
AutomatticWooCommerce8.5.0 < 8.5.4affected
AutomatticWooCommerce8.6.0 < 8.6.3affected
AutomatticWooCommerce8.7.0 < 8.7.2affected
AutomatticWooCommerce8.8.0 < 8.8.6affected
AutomatticWooCommerce8.9.0 < 8.9.4affected
AutomatticWooCommerce9.0.0 < 9.0.3affected
AutomatticWooCommerce9.1.0 < 9.1.5affected
AutomatticWooCommerce9.2.0 < 9.2.4affected
AutomatticWooCommerce9.3.0 < 9.3.5affected
AutomatticWooCommerce9.4.0 < 9.4.4affected
AutomatticWooCommerce9.5.0 < 9.5.3affected
AutomatticWooCommerce9.6.0 < 9.6.3affected
AutomatticWooCommerce9.7.0 < 9.7.2affected
AutomatticWooCommerce9.8.0 < 9.8.6affected
AutomatticWooCommerce9.9.0 < 9.9.6affected
AutomatticWooCommerce10.0.0 < 10.0.5affected
AutomatticWooCommerce10.1.0 < 10.1.3affected
AutomatticWooCommerce10.2.0 < 10.2.3affected
AutomatticWooCommerce10.3.0 < 10.3.7affected
AutomatticWooCommerce10.4.0 < 10.4.3affected

Weaknesses

  • CWE-639 Authorization Bypass Through User-Controlled Key

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References